Ansible: ansible_user in inventory vs remote_user in playbook

ansibleansible-2.xansible-inventory

I am trying to run an Ansible playbook against a server using an account other than the one I am logged on the control machine. I tried to specify an ansible_user in the inventory file according to the documentation on Inventory:

[srv1]
192.168.1.146 ansible_connection=ssh ansible_user=user1

However Ansible called with ansible-playbook -i inventory playbook.yml -vvvv prints the following:

GATHERING FACTS ***************************************************************
<192.168.1.146> ESTABLISH CONNECTION FOR USER: techraf

What worked for me was adding the remote_user argument to the playbook:

- hosts: srv1
  remote_user: user1

Now the same Ansible command connects as user1:

GATHERING FACTS ***************************************************************
<192.168.1.146> ESTABLISH CONNECTION FOR USER: user1

Also adding remote_user variable to ansible.cfg makes Ansible use the intended user instead of the logged-on one.

Are the ansible_user in inventory file and remote_user in playbook/ansible.cfg for different purposes?

What is the ansible_user used for? Or why doesn't Ansible observe the setting in the inventory?

Best Answer

You're likely running into a common issue: the published ansible docs are for the development version (2.0 right now), and we don't keep the old ones around. It's a big point of contention... Assuming you're using something pre-2.0, the inventory var name you need is ansible_ssh_user. ansible_user works in 2.0 (as does ansible_ssh_user- it gets aliased in).

Related Solutions

Specifying ssh key in ansible playbook file

The variable name you're looking for is ansible_ssh_private_key_file.

You should set it at 'vars' level:

in the inventory file:

  myHost ansible_ssh_private_key_file=~/.ssh/mykey1.pem
  myOtherHost ansible_ssh_private_key_file=~/.ssh/mykey2.pem

in the host_vars:

  # host_vars/myHost.yml
  ansible_ssh_private_key_file: ~/.ssh/mykey1.pem

  # host_vars/myOtherHost.yml
  ansible_ssh_private_key_file: ~/.ssh/mykey2.pem

in a group_vars file if you use the same key for a group of hosts

in the vars section of an entry in a play:

  - hosts: myHost
    remote_user: ubuntu
    vars_files:
      - vars.yml
    vars:
      ansible_ssh_private_key_file: "{{ key1 }}"
    tasks:
      - name: Echo a hello message
        command: echo hello

in setting a fact in a play entry (task):

     - name: 'you name it'
       ansible.builtin.set_fact:
         ansible_ssh_private_key_file: "{{ key1 }}"

Inventory documentation

Using –become for ansible_connection=local

Nothing special is required. Proof:

The playbook:

---
- hosts: localhost
  gather_facts: no
  connection: local
  tasks:
    - command: whoami
      register: whoami
    - debug:
        var: whoami.stdout

The execution line:
```
ansible-playbook playbook.yml --become
```

The result:

PLAY [localhost] ***************************************************************************************************

TASK [command] *****************************************************************************************************
changed: [localhost]

TASK [debug] *******************************************************************************************************
ok: [localhost] => {
    "changed": false,
    "whoami.stdout": "root"
}

PLAY RECAP *********************************************************************************************************
localhost                  : ok=2    changed=1    unreachable=0    failed=0

The ESTABLISH LOCAL CONNECTION FOR USER: message will always show the current user, as it the account used "to connect".

Later the command(s) called from the module get(s) executed with elevated permissions.

Of course, you can add become: yes on either play level or for individual tasks.

Best Answer

Related Solutions

Specifying ssh key in ansible playbook file

Using –become for ansible_connection=local

Related Topic